Attack Context

Black-box Research

Attacks requiring no knowledge of model internals

736 matching entries

Black-box research results

736 entries

Selective Hate Speech Jailbreak

Published Jan 7, 2026Analyzed Mar 8, 2026Source: arXiv

Instruction-tuned Large Language Models (LLMs) exhibit a selective safety alignment vulnerability, allowing attackers to bypass hate speech filters by shifting the demographic target of an adversarial prompt. Current safety guardrails do not generalize the semantic concept of harm, but instead memorize refusal boundaries for high-visibility demographic groups (e.g., Black, LGBTQIA+). Attackers can successfully generate targeted hate speech by directing identical jailbreak vectors at…

Safety Is Not Universal: The Selective Safety Trap in LLM Alignment

Evaluated models: Llama 3.2 1B Instruct, Gemma 3 1B IT, Qwen 3 1.7B FP8+10 more

Llama 3.2 1B Instruct
Gemma 3 1B IT
Qwen 3 1.7B FP8
Llama 3.2 3B Instruct
Gemma 3 4B IT
Qwen 3 4B FP8
Llama 3.1 8B Instruct
Gemma 3 12B IT
Qwen 3 8B FP8
Llama 3.3 70B Instruct
Gemma 3 27B IT
Qwen 3 32B FP8
GPT-4o Mini

Unsafe Search Framing

Published Jan 7, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in search-augmented Large Language Models (LLMs) allows attackers to bypass safety alignments and generate actionable malicious content by weaponizing the model's web retrieval tools. The exploit operates in two stages. First, via "Outsourcing Injection," attackers obfuscate harmful intent by translating it into benign-looking, multi-hop knowledge-seeking queries. This forces the LLM to fetch the harmful semantics directly from the open web, bypassing parametric intent filters…

SearchAttack: Red-Teaming LLMs against Real-World Threats via Framing Unsafe Web Information-Seeking Tasks

Evaluated models: GPT-4o, Gemini 3 Flash, DeepSeek V3.2+1 more

GPT-4o
Gemini 3 Flash
DeepSeek V3.2
Qwen 3 32B Instruct

Gamified Goal Pursuit Jailbreak

Published Jan 6, 2026Analyzed Feb 20, 2026Source: arXiv

A "Gamified Adversarial Multimodal Breakout via Instructional Traps" (GAMBIT) vulnerability exists in the safety alignment mechanisms of Multimodal Large Language Models (MLLMs), specifically those employing Chain-of-Thought (CoT) reasoning. The vulnerability exploits the finite cognitive resource budget of the model by inducing "cognitive overload" through a high-stakes, gamified context. The attack functions by decomposing a harmful query into a visual puzzle (e.g., a shuffled grid of image…

GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Models

Evaluated models: GPT-4o, Grok 2 Vision, GLM-4.1V Thinking+3 more

GPT-4o
Grok 2 Vision
GLM-4.1V Thinking
QVQ-Max
Gemini 2.5 Flash
o4-mini

Gradient-Free Transferable Jailbreak

Published Jan 6, 2026Analyzed Feb 20, 2026Source: arXiv

Large Language Models (LLMs) are vulnerable to a gray-box adversarial attack method known as RAILS (RAndom Iterative Local Search). This vulnerability allows an attacker with access to model output logits (but without access to gradients or weights) to optimize discrete adversarial suffixes that bypass safety alignment. The attack employs a random local search guided by a hybrid loss function combining Teacher-Forcing and a novel Auto-Regressive loss that enforces exact target prefix matching…

Jailbreaking LLMs Without Gradients or Priors: Effective and Transferable Attacks

Evaluated models: Llama 2 7B Chat, Llama 3 8B Instruct, Vicuna 7B v1.5+5 more

Llama 2 7B Chat
Llama 3 8B Instruct
Vicuna 7B v1.5
Qwen 7B Chat
Baichuan 2 7B Chat
GPT-3.5 Turbo
GPT-4 Turbo
Gemini 1.5 Pro

Multi-Turn Lexical Jailbreak

Published Jan 6, 2026Analyzed Feb 21, 2026Source: arXiv

A multi-turn jailbreak vulnerability exists in aligned Large Language Models (LLMs) via a technique known as Lexical Anchor Tree Search (LATS). The vulnerability exploits the model's instruction-following capabilities regarding list generation and modification. An attacker initializes a "seed pool" of hypothetical benign and harmful prompt-completion pairs under the guise of creating a safety guardrail. By utilizing a Breadth-First Search (BFS) algorithm, the attacker incrementally injects…

Break Me If You Can: Self-Jailbreaking of Aligned LLMs via Lexical Insertion Prompting

Evaluated models: GPT-4o, GPT-5.1, Claude 3.5 Sonnet+6 more

GPT-4o
GPT-5.1
Claude 3.5 Sonnet
Claude 3 Opus
Llama 3.1 8B Instruct
Llama 2 7B Chat
Mistral 7B Instruct
Mistral 7B
Vicuna 13B

Production LLM Copyright Extraction

Published Jan 6, 2026Analyzed Feb 21, 2026Source: arXiv

Production Large Language Models (LLMs) are vulnerable to long-form training data extraction via a two-phase prompt injection attack. This vulnerability allows an attacker to recover substantial portions of memorized, copyrighted text (such as novels) by exploiting the model's autoregressive text completion capabilities. The attack methodology involves two distinct phases: 1. Prefix Completion Probe: The attacker provides a short "seed" sequence (e.g., the first sentence of a book) coupled…

Extracting Books from Production Language Models

Evaluated models: Claude 3.7 Sonnet 20250219, GPT-4.1 2025-04-14, Gemini 2.5 Pro+1 more

Claude 3.7 Sonnet 20250219
GPT-4.1 2025-04-14
Gemini 2.5 Pro
Grok 3

AI Agent Structural Blindspot

Published Jan 5, 2026Analyzed Mar 9, 2026Source: arXiv

A vulnerability in AI agent threat detection systems relying on standard conversational tokenization allows attackers to bypass security monitors and execute structural attacks, such as tool hijacking and data exfiltration. Because traditional NLP-based detectors focus on linguistic patterns (surface language) rather than execution flow, an attacker can orchestrate malicious multi-step tool sequences using entirely benign natural language. This structural blindness causes cross-attack…

Structural Representations for Cross-Attack Generalization in AI Agent Threat Detection

Evaluated models: Not reported

Black-Box Vision-Language Jailbreak

Published Jan 5, 2026Analyzed Feb 21, 2026Source: arXiv

Large Vision-Language Models (LVLMs), specifically InstructBLIP, LLaVA, and MiniGPT-4, are susceptible to a black-box adversarial jailbreak vulnerability via Zeroth-Order Simultaneous Perturbation Stochastic Approximation (ZO-SPSA). An attacker can generate adversarial images with imperceptible perturbations that, when paired with harmful text prompts, bypass the model's safety alignment mechanisms (such as RLHF). Unlike traditional white-box attacks, this method does not require access to…

Crafting Adversarial Inputs for Large Vision-Language Models Using Black-Box Optimization

Evaluated models: Llama 2 13B, InstructBLIP, Vicuna 13B

Prompt Steers Instrumental Convergence

Published Jan 4, 2026Analyzed Mar 8, 2026Source: arXiv

Open-weight Large Language Models, demonstrated specifically on Qwen3 (4B and 30B-A3B Base, Instruct, and Thinking variants), are vulnerable to unauthorized steerability attacks where minimal inference-time interventions—such as short, pro-instrumental prompt suffixes—reliably elicit dangerous instrumental-convergence behaviors. Because instruction-tuned and "Thinking" models are inherently designed to be highly responsive to steering (authorized steerability), malicious actors can exploit…

Steerability of Instrumental-Convergence Tendencies in LLMs

Evaluated models: Qwen 3 4B Base, Qwen 3 4B Instruct, Qwen 3 4B Thinking+3 more

Qwen 3 4B Base
Qwen 3 4B Instruct
Qwen 3 4B Thinking
Qwen 3 30B-A3B Base
Qwen 3 30B-A3B Instruct
Qwen 3 30B-A3B Thinking

Truthful Montage Collusion

Published Jan 4, 2026Analyzed Feb 22, 2026Source: arXiv

A cognitive vulnerability exists in the reasoning mechanisms of autonomous Large Language Model (LLM) agents, specifically regarding "narrative overfitting"—the model's intrinsic drive to synthesize coherent causal stories from fragmented inputs. This vulnerability allows for "Cognitive Collusion Attacks" where an attacker creates a fabricated belief state in the victim agent using exclusively factually true evidence fragments. By employing a "Generative Montage" framework (consisting of…

Lying with Truths: Open-Channel Multi-Agent Collusion for Belief Manipulation via Generative Montage

Evaluated models: GPT-4o Mini, GPT-4o, GPT-4.1 Nano+11 more

GPT-4o Mini
GPT-4o
GPT-4.1 Nano
GPT-4.1 Mini
GPT-4.1
Claude 3 Haiku
Claude 3.5 Haiku
Claude Haiku 4.5
Qwen 2.5 3B Instruct
Qwen 2.5 7B Instruct
Qwen 2.5 14B Instruct
DeepSeek R1 Distill Qwen 1.5B
DeepSeek R1 Distill Qwen 7B
DeepSeek R1 Distill Qwen 14B

Related research categories